Sticky Isolation for Navigation in Isolated Tabs
Learn how Sticky Isolation keeps navigation from an isolated session inside
isolation, even when the destination's URL category isn't set to isolate.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
Prisma Access
license with the
Mobile User or Remote Networks license subscription Sticky Isolation enabled for your tenant. Contact your Palo
Alto Networks account representative to enable the
feature. A URL Filtering profile attached to the Security policy
rules that apply to your isolated traffic HTTPS decryption for the destination traffic QUIC traffic blocked, with no broader Security policy rule
above the block that allows it - SaaS Agent Versions 7.1 and above
|
By default, your URL Filtering profile decides whether each web request is isolated,
based on the request's URL category, and RBI isolates the requests
that the profile sets to isolate. When a user in an isolated session clicks a link to a
destination in a URL category that you don't isolate, the page opens in the local
browser outside isolation. This can cause links in isolated applications, such as
file-sharing links in an isolated webmail session, escape to the local browser, and the
endpoint is exposed to content that you meant to isolate. Also, web applications that
redirect to an external identity provider for sign-in load partly in isolation and
partly in the local browser, which breaks the sign-in. With Sticky Isolation, navigation
that starts in an isolated session stays in isolation even when the destination's URL
category isn't set to isolate. Block actions still take precedence.
This feature is enabled on request. Contact your Palo Alto Networks account
representative to enable the feature for your tenant. After the feature is enabled,
enable Sticky Isolation in an isolation profile. When a user navigates from a page in an
isolated session, RBI keeps the destination in isolation and
applies the isolation profile of the session that the user started in. The user
continues in the same isolated tab.
Sticky Isolation is disabled by default and applies to each isolation profile
separately. Existing isolation profiles keep their current behavior until you
enable it.
Sticky Isolation applies to navigation from an isolated tab, including links and
redirects to other sites, such as a redirect to an identity provider. Pages that
a user opens in a new tab from an isolated tab also open in isolation with the
same isolation profile.
A page that opens through Sticky Isolation uses the same isolation profile
controls, such as Copy, Paste, Upload, Download, and Print, as the page that the
user navigated from. If users open the same destination from isolated tabs that
use different isolation profiles, the destination uses the controls of the
profile that the originating tab used. For example, if a profile blocks copy and
download, a page opened from that tab also blocks them. If a user opens the same
page from a tab whose profile allows copy and paste, the page allows them.
Your existing blocks still apply. RBI blocks destinations
that your custom URL categories, predefined blocked categories, or Security
policy deny rules block. For a destination in a predefined blocked category, the
user sees the block page inside isolation.
The navigation that Sticky Isolation keeps in isolation appears in the URL
Filtering logs in
Log Viewer with the URL category
GPCS-rbi-sticky-marker and the action isolate.
If a user refreshes a page that opened through Sticky Isolation, RBI evaluates the page's address on its own. If the page's
URL category isn't set to isolate, the page loads in the local browser outside
isolation. To return the page to isolation, the user must select the link on the
isolated page again.
